readykernel-patch-73.24-72.1-1.vl7

It was discovered that a malicious user inside a Virtuozzo container could potentially overwrite "vzctl" binary on the host. The attacker could replace executables in that container with symlinks to /proc/self/exe. After that, "vzctl exec" called from the host to run one of such executables would try to run the host's "vzctl" there instead. If the attacker managed to intercept that, they would be able to change the contents of the host's "vzctl" binary. The issue is similar to CVE-2019-5736, but affects "vzctl" rather than "runc".

A flaw was found in the implementation of userfaultfd. An attacker is able to bypass file permissions on filesystems mounted with tmpfs/hugetlbs to modify a file and possibly disrupt normal system behaviour. At this time there is an understanding there is no crash or priviledge escalation but the impact of modifications on these filesystems of files in production systems may have adverse affects.

Debug message 'IPVS: Creating netns size=... id=...' could be output many times to the system log when the network namespaces are initialized, making the log less readable.

A flaw was found in the implementation of ebtables in the Linux kernel. A local attacker in a container could exploit it to consume large amounts of memory, eventually causing denial of service on the host.